# KB5009555: January 2022 cumulative update for Windows Server 2022 KB5009555, released January 11, 2022, fixes 80 CVEs across 2 products. 2 of them are being exploited (CVE-2022-21882); 2 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/microsoft/kb5009555 - Platform: Microsoft - Released: Jan 11, 2022 - Priority: Patch now (Closes CVE-2022-21882, exploited (CISA KEV, ransomware)) - CVEs: 80, exploited: 2, on CISA KEV: 2 - Vendor advisory: https://support.microsoft.com/help/5009555 ## Applies to | Product | Release | Fixed in | |---|---|---| | [Windows Server 2022](https://patchblox.com/security/data/product/microsoft/windows-server-2022.md) | | 20348.469 | | [Windows Server 2022 (Server Core installation)](https://patchblox.com/security/data/product/microsoft/windows-server-2022-server-core-installation.md) | | 20348.469 | ## CVEs this fix closes | CVE | Priority | Component | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2022-21882](https://patchblox.com/security/data/cve/CVE-2022-21882.md) | Patch now | Windows Win32K | 7.0 | 0.5921 | CISA KEV, Ransomware | | [CVE-2022-21919](https://patchblox.com/security/data/cve/CVE-2022-21919.md) | Patch now | Windows User Profile Service | 7.0 | 0.0257 | CISA KEV, Disclosed | | [CVE-2022-21907](https://patchblox.com/security/data/cve/CVE-2022-21907.md) | Urgent | Windows HTTP Protocol Stack | 9.8 | 0.9279 | More likely | | [CVE-2022-21881](https://patchblox.com/security/data/cve/CVE-2022-21881.md) | Urgent | Windows Kernel | 7.0 | 0.2452 | More likely | | [CVE-2021-22947](https://patchblox.com/security/data/cve/CVE-2021-22947.md) | Urgent | Open Source Software | 6.1 | 0.0301 | Disclosed | | [CVE-2022-21857](https://patchblox.com/security/data/cve/CVE-2022-21857.md) | Urgent | Windows Active Directory | 8.8 | 0.0264 | | | [CVE-2022-21898](https://patchblox.com/security/data/cve/CVE-2022-21898.md) | Urgent | Windows DirectX | 7.8 | 0.0255 | | | [CVE-2022-21897](https://patchblox.com/security/data/cve/CVE-2022-21897.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.0109 | More likely | | [CVE-2022-21916](https://patchblox.com/security/data/cve/CVE-2022-21916.md) | Urgent | Windows Common Log File System Driver | 7.8 | 0.0100 | More likely | | [CVE-2022-21908](https://patchblox.com/security/data/cve/CVE-2022-21908.md) | Urgent | Windows Installer | 7.8 | 0.0093 | More likely | | [CVE-2022-21903](https://patchblox.com/security/data/cve/CVE-2022-21903.md) | Urgent | Microsoft Graphics Component | 7.0 | 0.0084 | More likely | | [CVE-2022-21885](https://patchblox.com/security/data/cve/CVE-2022-21885.md) | Urgent | Windows Remote Access Connection Manager | 7.8 | 0.0069 | More likely | | [CVE-2022-21914](https://patchblox.com/security/data/cve/CVE-2022-21914.md) | Urgent | Windows Remote Access Connection Manager | 7.8 | 0.0069 | More likely | | [CVE-2022-21833](https://patchblox.com/security/data/cve/CVE-2022-21833.md) | Urgent | Windows Virtual Machine IDE Drive | 7.8 | 0.0065 | | | [CVE-2022-21893](https://patchblox.com/security/data/cve/CVE-2022-21893.md) | High | Windows RDP | 8.0 | 0.0863 | | | [CVE-2022-21849](https://patchblox.com/security/data/cve/CVE-2022-21849.md) | High | Windows IKE Extension | 9.8 | 0.0659 | | | [CVE-2022-21883](https://patchblox.com/security/data/cve/CVE-2022-21883.md) | High | Windows IKE Extension | 7.5 | 0.0464 | | | [CVE-2022-21848](https://patchblox.com/security/data/cve/CVE-2022-21848.md) | High | Windows IKE Extension | 7.5 | 0.0440 | | | [CVE-2022-21880](https://patchblox.com/security/data/cve/CVE-2022-21880.md) | High | Microsoft Graphics Component | 7.5 | 0.0410 | | | [CVE-2022-21904](https://patchblox.com/security/data/cve/CVE-2022-21904.md) | High | Microsoft Graphics Component | 7.5 | 0.0373 | | | [CVE-2022-21843](https://patchblox.com/security/data/cve/CVE-2022-21843.md) | High | Windows IKE Extension | 7.5 | 0.0356 | | | [CVE-2022-21889](https://patchblox.com/security/data/cve/CVE-2022-21889.md) | High | Windows IKE Extension | 7.5 | 0.0320 | | | [CVE-2022-21890](https://patchblox.com/security/data/cve/CVE-2022-21890.md) | High | Windows IKE Extension | 7.5 | 0.0320 | | | [CVE-2022-21850](https://patchblox.com/security/data/cve/CVE-2022-21850.md) | High | Windows RDP | 8.8 | 0.0294 | | | [CVE-2022-21851](https://patchblox.com/security/data/cve/CVE-2022-21851.md) | High | Windows RDP | 8.8 | 0.0294 | | | [CVE-2022-21920](https://patchblox.com/security/data/cve/CVE-2022-21920.md) | High | Windows Kerberos | 8.8 | 0.0293 | | | [CVE-2022-21922](https://patchblox.com/security/data/cve/CVE-2022-21922.md) | High | Windows Remote Procedure Call Runtime | 8.8 | 0.0293 | | | [CVE-2021-36976](https://patchblox.com/security/data/cve/CVE-2021-36976.md) | High | Windows Libarchive | n/a | 0.0285 | Disclosed | | [CVE-2022-21878](https://patchblox.com/security/data/cve/CVE-2022-21878.md) | High | Windows Geolocation Service | 7.8 | 0.0281 | | | [CVE-2022-21888](https://patchblox.com/security/data/cve/CVE-2022-21888.md) | High | Windows Modern Execution Server | 7.8 | 0.0269 | | | [CVE-2022-21874](https://patchblox.com/security/data/cve/CVE-2022-21874.md) | High | Windows Security Center | 7.8 | 0.0248 | Disclosed | | [CVE-2022-21895](https://patchblox.com/security/data/cve/CVE-2022-21895.md) | High | Windows User Profile Service | 7.8 | 0.0126 | | | [CVE-2022-21901](https://patchblox.com/security/data/cve/CVE-2022-21901.md) | High | Role: Windows Hyper-V | 9.0 | 0.0095 | | | [CVE-2022-21860](https://patchblox.com/security/data/cve/CVE-2022-21860.md) | High | Windows AppContracts API Server | 7.0 | 0.0079 | | | [CVE-2022-21864](https://patchblox.com/security/data/cve/CVE-2022-21864.md) | High | Windows UI Immersive Server | 7.0 | 0.0079 | | | [CVE-2022-21865](https://patchblox.com/security/data/cve/CVE-2022-21865.md) | High | Windows Connected Devices Platform Service | 7.0 | 0.0079 | | | [CVE-2022-21836](https://patchblox.com/security/data/cve/CVE-2022-21836.md) | High | Windows Certificates | 7.8 | 0.0072 | Disclosed | | [CVE-2022-21852](https://patchblox.com/security/data/cve/CVE-2022-21852.md) | High | Windows DWM Core Library | 7.8 | 0.0071 | | | [CVE-2022-21858](https://patchblox.com/security/data/cve/CVE-2022-21858.md) | High | Windows Bind Filter Driver | 7.8 | 0.0071 | | | [CVE-2022-21871](https://patchblox.com/security/data/cve/CVE-2022-21871.md) | High | Windows Diagnostic Hub | 7.0 | 0.0070 | | | [CVE-2022-21870](https://patchblox.com/security/data/cve/CVE-2022-21870.md) | High | Tablet Windows User Interface | 7.0 | 0.0069 | | | [CVE-2022-21872](https://patchblox.com/security/data/cve/CVE-2022-21872.md) | High | Windows Event Tracing | 7.0 | 0.0069 | | | [CVE-2022-21873](https://patchblox.com/security/data/cve/CVE-2022-21873.md) | High | Windows Tile Data Repository | 7.0 | 0.0069 | | | [CVE-2022-21875](https://patchblox.com/security/data/cve/CVE-2022-21875.md) | High | Windows Storage | 7.0 | 0.0069 | | | [CVE-2022-21863](https://patchblox.com/security/data/cve/CVE-2022-21863.md) | High | Windows StateRepository API | 7.0 | 0.0069 | | | [CVE-2022-21867](https://patchblox.com/security/data/cve/CVE-2022-21867.md) | High | Windows Push Notifications | 7.0 | 0.0069 | | | [CVE-2022-21835](https://patchblox.com/security/data/cve/CVE-2022-21835.md) | High | Windows Cryptographic Services | 7.8 | 0.0069 | | | [CVE-2022-21884](https://patchblox.com/security/data/cve/CVE-2022-21884.md) | High | Windows Local Security Authority Subsystem Service (LSASS) | 7.8 | 0.0069 | | | [CVE-2022-21902](https://patchblox.com/security/data/cve/CVE-2022-21902.md) | High | Windows DWM Core Library | 7.8 | 0.0068 | | | [CVE-2022-21861](https://patchblox.com/security/data/cve/CVE-2022-21861.md) | High | Windows Task Flow Data Engine | 7.0 | 0.0068 | | | [CVE-2022-21869](https://patchblox.com/security/data/cve/CVE-2022-21869.md) | High | Windows Clipboard User Service | 7.0 | 0.0068 | | | [CVE-2022-21868](https://patchblox.com/security/data/cve/CVE-2022-21868.md) | High | Windows Devices Human Interface | 7.0 | 0.0067 | | | [CVE-2022-21834](https://patchblox.com/security/data/cve/CVE-2022-21834.md) | High | Windows User-mode Driver Framework | 7.0 | 0.0065 | | | [CVE-2022-21859](https://patchblox.com/security/data/cve/CVE-2022-21859.md) | High | Windows Account Control | 7.0 | 0.0065 | | | [CVE-2022-21862](https://patchblox.com/security/data/cve/CVE-2022-21862.md) | High | Windows Application Model | 7.0 | 0.0065 | | | [CVE-2022-21910](https://patchblox.com/security/data/cve/CVE-2022-21910.md) | High | Windows Cluster Port Driver | 7.8 | 0.0061 | | | [CVE-2022-21896](https://patchblox.com/security/data/cve/CVE-2022-21896.md) | High | Windows DWM Core Library | 7.0 | 0.0060 | | | [CVE-2022-21866](https://patchblox.com/security/data/cve/CVE-2022-21866.md) | High | Windows System Launcher | 7.0 | 0.0060 | | | [CVE-2022-21894](https://patchblox.com/security/data/cve/CVE-2022-21894.md) | Routine | Windows Secure Boot | 4.4 | 0.0912 | | | [CVE-2022-21924](https://patchblox.com/security/data/cve/CVE-2022-21924.md) | Routine | Windows Workstation Service Remote Protocol | 5.3 | 0.0307 | | | [CVE-2022-21877](https://patchblox.com/security/data/cve/CVE-2022-21877.md) | Routine | Windows Storage Spaces Controller | 5.5 | 0.0294 | | | [CVE-2022-21915](https://patchblox.com/security/data/cve/CVE-2022-21915.md) | Routine | Microsoft Graphics Component | 6.5 | 0.0292 | | | [CVE-2022-21913](https://patchblox.com/security/data/cve/CVE-2022-21913.md) | Routine | Windows Local Security Authority | 5.3 | 0.0284 | | | [CVE-2022-21838](https://patchblox.com/security/data/cve/CVE-2022-21838.md) | Routine | Windows Cleanup Manager | 5.5 | 0.0152 | | | [CVE-2022-21876](https://patchblox.com/security/data/cve/CVE-2022-21876.md) | Routine | Windows Win32K | 5.5 | 0.0132 | | | [CVE-2022-21906](https://patchblox.com/security/data/cve/CVE-2022-21906.md) | Routine | Windows Defender | 5.5 | 0.0113 | | | [CVE-2022-21918](https://patchblox.com/security/data/cve/CVE-2022-21918.md) | Routine | Windows DirectX | 6.5 | 0.0112 | | | [CVE-2022-21879](https://patchblox.com/security/data/cve/CVE-2022-21879.md) | Routine | Windows Kernel | 5.5 | 0.0105 | | | [CVE-2022-21847](https://patchblox.com/security/data/cve/CVE-2022-21847.md) | Routine | Role: Windows Hyper-V | 6.5 | 0.0102 | | | [CVE-2022-21921](https://patchblox.com/security/data/cve/CVE-2022-21921.md) | Routine | Windows Defender | 4.4 | 0.0092 | | | [CVE-2022-21892](https://patchblox.com/security/data/cve/CVE-2022-21892.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21958](https://patchblox.com/security/data/cve/CVE-2022-21958.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21959](https://patchblox.com/security/data/cve/CVE-2022-21959.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21960](https://patchblox.com/security/data/cve/CVE-2022-21960.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21961](https://patchblox.com/security/data/cve/CVE-2022-21961.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21962](https://patchblox.com/security/data/cve/CVE-2022-21962.md) | Routine | Windows Resilient File System (ReFS) | 6.8 | 0.0076 | | | [CVE-2022-21905](https://patchblox.com/security/data/cve/CVE-2022-21905.md) | Routine | Role: Windows Hyper-V | 4.6 | 0.0075 | | | [CVE-2022-21963](https://patchblox.com/security/data/cve/CVE-2022-21963.md) | Routine | Windows Resilient File System (ReFS) | 6.4 | 0.0072 | | | [CVE-2022-21900](https://patchblox.com/security/data/cve/CVE-2022-21900.md) | Routine | Role: Windows Hyper-V | 4.6 | 0.0068 | | | [CVE-2022-21928](https://patchblox.com/security/data/cve/CVE-2022-21928.md) | Routine | Windows Resilient File System (ReFS) | 6.3 | 0.0067 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo